Bugging Incident at Open AI
Recording device discovered by technical surveillance countermeasures team.
What:
An employee of OpenAI has been arrested for and charged with “using or endeavoring to use an electronic, mechanical, or other device” to intercept oral communications.
The TSCM team at OpenAI had discovered the device during a sweep.
Who:
From the Department of Justice:
Abdulrahman Alfozan, 35, a national of the Kingdom of Saudi Arabia, was arrested on Oct. 9, and made his initial appearance in federal court today (Oct 13, 2026). Alfozan had been employed as an engineer by OpenAI since July 2025.
How:
… “According to the complaint unsealed today, Abdulrahman Alfozan allegedly concealed a covert recording device inside his employer’s executive conference room to secretly capture sensitive communications about the company’s super intelligence technology,” said FBI Director Kash Patel.
On or about Sept. 30, OpenAI personnel discovered a surreptitious audio recording device (Recording Device 1) inserted into a USB port on the back of a television in an executive conference room inside one of their buildings in San Francisco. OpenAI determined that the device, which had been concealed in toilet paper, was installed on or about Sept. 28, and that its contents were encrypted.
Additional details:
Closed-circuit television (CCTV) footage inside OpenAI’s office showed that Alfozan appeared near the executive conference room on multiple dates prior to the device’s discovery, although he had no authority to access or to participate in meetings occurring in the executive conference room. According to the complaint, meetings in the executive conference room where Recording Device 1 was discovered frequently involved discussions of highly confidential technical, commercial, and strategic information, including proprietary research, product plans, and business-development opportunities, as well as nonpublic information about Open AI’s technical progress and strategic decisions, capabilities, priorities, government engagements, and commercial relationships.
According to the complaint, prior to Sept. 28, Alfozan used a productivity tool to make multiple inquiries about Open AI’s building addresses, meeting rooms, meeting-room capacities and calendars, “leadership and exec” locations, and external partner meetings. Moreover, a chatbot account associated with Alfozan’s spouse (which shared multiple identifiers and attributes with Alfozan’s own chatbot account) submitted prompts between Sept. 24 and Sept. 30 related to building, customizing, installing, audio recording, testing, obfuscating, and remote accessing a device, including inquiries about “building a continuous audio recorder,” “customizing Wi-Fi . . . connectivity,” “improving]audio and live listening,” and “encrypting the SD card,” among other things. The same chatbot account also submitted prompts specifically related to Recording Device 1, including its custom header and unique MAC address, between Sept. 27 and Sept. 28.
The complaint further alleges that on Oct. 5, Alfozan entered the executive conference room and appeared to look behind the television into which Recording Device 1 had been inserted, as captured below:
Alfozan, captured on CCTV, apparently returned to check on his device only to find it had been removed.
Take-aways:
Access control- This case is a perfect example of insider-threat manifesting itself. The perpetrator already has access to the area, and being part of the company, can take time to research the best or easiest method to conduct the surveillance.
Why a TV USB port? Unlimited power.
All electronic devices need some sort of power source in order to operate. Surveillance devices may use batteries, many easily obtainable spy recording devices can run for days on a single charge. But by plugging into a USB port, the device can have unlimited power as long as the host device is plugged in and powering its ports.
Check all ports.
When conducting TSCM sweeps, it is important to always check any and all ports that might be able to supply power. These can be found on the back of TV displays, computer monitors, computers themselves, AV conference equipment (often found underneath boardroom tables), and many other locations. USB ports are most common, but other ports, such as HDMI, may also supply power. Any unexpected devices should be treated as suspicious.
Any stray USB devices that may be found lying around should be collected and inspected by your IT team. They could contain malware or other modifications to turn them into surveillance devices.
Monitor and log WiFi, communicate with your TSCM team.
This device had some WiFi capability. Whether WiFi was used or not isn’t clear from the reports.
It can be challenging for the IT team to stay on top of all WiFi signals throughout your facilities. Your TSCM sweeps will be checking WiFi and looking for any anomalous or out-of-place signals. Keep in communication with your teams so that any questions that arise can be addressed.
Maintain confidentiality.
This case is also an example of maintaining confidentiality regarding any such security incidents. The device was first discovered on September 30, 2026 but information was not made public until October 13. Many cases may never have law enforcement involved. Companies would usually rather have such incidents go away quietly.
If you have a discovery, you should assume that eventually law enforcement may be involved, therefore handle all discoveries with care. Everything touched might become evidence so proceed with caution (use rubber gloves to avoid fingerprint contamination). Document all steps taken and maintain a chain of evidence.
Forensic analysis of a recording device can provide a lot of information. In a recent discovery of a recording device our forensic team was able to not only recover audio files from the device but also identify computers that had accessed the device by comparing electronic signature data with laptops belonging to the company. This led directly to the perpetrator.
What’s up with the toilet paper?
The reports say that the device was wrapped in toilet paper. That seems like an easy give-a-way that something is not right. Bad guys aren’t always smart. From the photo it appears that the device may have been inserted into a toilet paper roll, or wrapped around with paper just as a way to keep all the components together. If it had been placed into a small black plastic case, it would have been much harder to spot.
Second device discovered
Alfozan had also left a bag unattended in a printer room. Security personnel found and opened the bag and discovered-among other things, including Alfozan’s wallet, ID, and other personal items-another recording device. Like the first device, recording device 2, which is depicted below, is also manufactured by Seeed.
Recording Device 2 also had a recording microcontroller; and had been encrypted to obfuscate anything stored on the device, such as potentially intercepted audio communications.
The equipment used appears to be the following inexpensive devices.
Some of the areas we check regularly on our TSCM sweeps include computers, TV and monitor ports, equipment under conference tables, AV rack equipment, even hotel rooms often have power sources that are hard to notice.
These areas should all be checked regularly. Also very important is keeping good communications between all aspects of security, from access control, to IT security, to guard patrols, and of course, technical surveillance countermeasures. A small incident in one area could be connected to larger issues affecting the entire corporation.
For more information you can review the following posts:
DOJ
https://www.justice.gov/opa/pr/saudi-national-arrested-installing-surreptitious-audio-recording-device-openai
CNBC
https://www.cnbc.com/2026/10/14/openai-alfozan-recording-raed-ventures.html
Firstpost.com
https://www.firstpost.com/explainers/who-is-abdulrahman-alfozan-openai-engineer-arrested-in-us-for-bugging-office-14052744.html